CVE-2019-6005 Auth bypass in firmware version prior to 1300
Remote attackers can bypass access restrictions on Smart TV Boxes to install arbitrary software or change settings via the Android Debug Bridge port.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-6005?
CVE-2019-6005 is a critical authentication bypass vulnerability in Smart TV Box firmware version prior to 1300, published on 12 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Smart TV Box firmware version prior to 1300 allows remote attackers to bypass access restriction to conduct arbitrary operations on the device without user's intent, such as installing arbitrary software or changing the device settings via Android Debug Bridge port 5555/TCP.
Which versions are affected by CVE-2019-6005?
It affects 1 product.
Products include Kddi Smart Tv Box Firmware.
How do I fix CVE-2019-6005?
No fix has been published for CVE-2019-6005 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-6005 being exploited?
There is no known exploitation of CVE-2019-6005 in the wild and no public exploit code.
Sources
Also known as GHSA-cjm9-34g2-v82g.